CVE-2025-5949

The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to processing a password change request. This makes it possible for authenticated attackers with subscriber access or higher to reset other users' passwords, including those of admins.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793
https://www.wordfence.com/threat-intel/vulnerabilities/id/a2874a5f-71f4-4bcd-87e8-a20bb19a5847?source=cve

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El plugin Service Finder Bookings para WordPress es vulnerable a escalada de privilegios mediante toma de control de cuenta en todas las versiones hasta la 6.0, inclusive. Esto se debe a que el plugin no valida correctamente la identidad de un usuario antes de procesar una solicitud de cambio de contraseña. Esto hace posible que atacantes autenticados con acceso de suscriptor o superior restablezcan las contraseñas de otros usuarios, incluidas las de los administradores.

Information

Published : 2025-11-01 05:16

Updated : 2026-10-18 21:10

NVD link : CVE-2025-5949

Mitre link : CVE-2025-5949

CVE.ORG link : CVE-2025-5949

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-5949", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5949", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-03T20:48:33.168839Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "aonetheme", "product": "Service Finder Bookings", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.0"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-01T05:16:02.763", "references": [{"url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a2874a5f-71f4-4bcd-87e8-a20bb19a5847?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to processing a password change request. This makes it possible for authenticated attackers with subscriber access or higher to reset other users' passwords, including those of admins."}, {"lang": "es", "value": "El plugin Service Finder Bookings para WordPress es vulnerable a escalada de privilegios mediante toma de control de cuenta en todas las versiones hasta la 6.0, inclusive. Esto se debe a que el plugin no valida correctamente la identidad de un usuario antes de procesar una solicitud de cambio de contrase\u00f1a. Esto hace posible que atacantes autenticados con acceso de suscriptor o superior restablezcan las contrase\u00f1as de otros usuarios, incluidas las de los administradores."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "security@wordfence.com"}